The present invention relates to methods and apparatus for providing multiple levels of security in connection with the transmission of data from a source to a recipient.
As the Internet and Intranet communication dominates various application domains in government, business, industry and military area of interest, keeping both the data and the communication secured is becoming a growing challenge. As systems are more widely distributed, and the more extensively the Internet is used, the greater are the number of threats to the information traversing the Internet. The subversion of a single client or server may provide an attacker with immediate connectivity to the information and computing resources of an entire organization. This problem may only be addressed through a wide array of mechanisms and strategies to protect operating systems, sensitive data and databases, networks and transmission equipment. Unfortunately, the security problem has not heretofore been satisfactorily addressed.
Multi-Level Security (MLS) has been defined in the art as a class of systems containing information with different sensitivities that simultaneously permits access by users with different security levels without risk of compromising the sensitive data. The Defense Information System Agency (DISA) home page (http://www.disa.mil) defines Multi-Level Security as:                Allowing information about different sensitivities (classifications) to be stored in an information system;        Allowing users having different clearances, authorizations, and need to know the ability to process information in the same system; and        Preventing users from accessing information for which they are not cleared, do not have authorization, or do not have a need to know [2].        
The research on Multi-Level Security technology has been ongoing for many years. Multi-Level Security Systems overcome the operational limitations imposed by system-high operations and are conventionally considered the most secure and effective systems. The biggest advantage of an MLS System is that it allows users at each security level to receive appropriate information and multimedia updates in real time, which would be difficult without this architecture. In an MLS System, each user has the data that is appropriate for his/her security level. MLS guards and MLS workstations can be used to bridge security boundaries between existing single-level systems. MLS operating systems, MLS database management systems, and MLS networks can provide common data processing and data transfer platforms to serve as the foundation for MLS systems.
MLS Operating Systems were developed in the early 1980s and began to receive National Security Agency (NSA) evaluation in 1984. MLS operating systems provide complete mandatory and discretionary access control, thorough security identification of data devices, rigid control of transfer of data and access to devices, and complete auditing of access to the system and data. By implementing an MLS operating system, a security administrator is able to configure security clearance definitions and limitations, permitted special operational capabilities, file access control lists, and choice of password protection schemes. MLS operating systems provide security mechanisms and services that allow a computer system to distinguish and separate classified data and protect it against a malicious user's abuse of authority, direct probing, and human error. MLS operating systems lower the security risk of implementing a system that processes classified data. They also implement security policies and accountability mechanisms in an operating system package. A security policy is the rules and practices that determine how sensitive information is managed, protected, and distributed. Accountability mechanisms are the means of identifying and tracing who has had access to what data on the system so they can be held accountable for their actions.
An MLS Database Management System is designed to archive, retrieve and process information in compliance with certain mandatory security requirements that protect sensitive information from unauthorized access, modification and abuse. Conventional database management systems treat all data at the same security level and ignore different security levels of the data they store and retrieve. Multi-Level Secure Database Management schemes maintain a collection of data with mixed security levels. The access mechanisms allow users or programs with different levels of security clearance to operate only the data appropriate to their level.
Since 1975, research effort have been focused on the development of MLS Database Management System, where many architectures have been proposed, such as the trusted subject architecture, the integrity lock architecture, the kernelized architecture, the replicated architecture, and the distributed architecture. These architectures are more fully discussed in the following publications, which are hereby incorporated by reference in their entireties: Roshan K. Thomas, Ravi S. Sandhu, “A Trusted Subject Architecture for Multilevel Secure Object-Oriented Databases,” Transactions on Knowledge and Data Engineering of IEEE, Vol. 8, No. 1 (February 1996); Richard Graubart, “The Integrity-Lock Approach to Secure Database Management,” IEEE Symposium on Security and Privacy, p. 62 (1984); and Bhavani Thuraisingham, William Ford, “Security Constraint Processing in a Multilevel Secure Distributed Database Management System,” Transactions on Knowledge and Data Engineering of IEEE, pp. 274-293 (1995). These differing architectures suit different needs. For example, the Trusted Subject architecture is best for applications where the trusted operating system and the hardware used in the architecture already provide an assured, trusted path between applications and the MLS Database Management System. The Integrity Lock architecture provides the ability to label data down to the row (or record) level, the ability to implement a wide range of categories, and is easiest to validate. The Kernalized architecture scheme is economical and easier to implement for MLS Database Management System with more simple table structures. The Distributed architecture is best suited for MLS Database Management System where physical separation of data by security level is required.
Due to the distributed nature of the network architecture, the high degree of openness of the network medium and the intensive need for sharing resources within the network, the protection mechanisms residing in the individual computers that prevent unauthorized access to the files become inadequate to ensure the security of communications across the network. In the MLS Network, the enforcement mechanism is embedded in the network interface devices, network front-end processors, switches, routers and gateways to enforce the security policy for the network, handling information at different security classification levels and serving users with different security clearances. It controls the access to network equipment for which some users may not have the clearance to use, and it controls the flow of information between various network devices to prevent unauthorized dissemination. Further details concerning the MLS Network are discussed in the following publication, which is hereby incorporated by reference in its entirety: Wen-pai Lu, “A Model for Multilevel Security in Computer Networks,” IEEE Transactions on Software Engineering, Vol. 16, No. 6 (June 1990).
An implementation of an MLS Network is discussed in the following publication, which is hereby incorporated by reference in its entirety: Richard A. Griffith & Mac E. McGregor, “Designing & Operating a Multilevel Security Network Using Standard Commercial Products,” csrc.nist.gov/nissc/1996/papers/NISSC96/paper037/sctycon2.pdf. This network has unclassified and secret gateways and routers, where each workstation labels data unclassified or secret and transmits information to the proper gateway and router. Each gateway has an internal unlabeled and multilevel network interface card. The routers act as a firewall, hiding the network from the outside world. Identification and authentication within the MLN is through user identification and password.
In recent years, considerable research has been conducted to develop the concurrency control techniques and commit protocols for Multi-Level Secure Database Management Systems to ensure secure transaction processing. In such databases, transactions and data are labeled as having different security levels. Convert channels can cause leakage of information from one level to another level. Therefore, synchronizing readers and writers in an MLS environment becomes the main concern of secure transaction processing. The concurrency control protocol in Multi-Level Secure Database Management Systems need not only ensure correct execution of transaction, but also prevent the establishment of convert channels.
The secure transaction processing for popular Multi-Level Secure Database Management System architectures, such as kernelized, replicated, and distributed architectures, and advanced transaction models such as workflows, long duration and nested models have been developed. The replicated approach constructs an Multi-Level Secure Database Management System from a single-level Database Management System. The challenge is to design a replica control protocol that will ensure one-copy serializability. The common solution is that transactions are submitted to a global transaction manager, and the global transaction manager routes the transactions to their sites of origin and propagates the update projections to each of the domination containers in turn. For the kernelized architecture, snapshot algorithms have been proposed. A snapshot of data is created and maintained, and transactions read the snapshot. Transactions accessing data at their own level, access the current state of database. A more detailed discussion of existing multilevel secure transaction processing models and the associated technical challenges may be found in the following publication, which is hereby incorporated by reference in its entirety: Vijayalakshmi Atluri, Sushil Jajodia, Thomas F. Keefe, Catherine McCollum, and Ravi Mukkamala, “Multilevel Secure Transaction Processing: Status and Prospects,” Database Security, X: Status and Prospects, Chapman & Hall (1997).
A Multi-Level Security Web Server is another emerging trend that allows organizations to maintain a common data set on a single World Wide Web server that connects to multiple security domains/networks. This alleviates the need to maintain multiple servers and data sets, one for each domain or network. It also allows a single, common data resource to support multiple organizations where there is a requirement to restrict access to information based upon organizational or privacy needs. By placing all data on a single MLS Web Server, the time consuming and costly task of maintaining a common and consistent data set on multiple disconnected servers is alleviated.
Using a secure operating system, a secure web server, and secure database technology, information on the server can be segregated and maintained by categories, classification levels, or organizations. Individual users and groups can either be granted or denied access to this information based upon their authorization level, which is assigned by the system's security officer or administrator. Data can be organized hierarchically, if so desired, allowing users to access multiple sets of data and other information at and below their authorization level.